Out-of-Bounds Read in Linux Kernel SMB2 Write Vulnerability

CVE-2023-3865

What is CVE-2023-3865?

The Linux kernel contains a vulnerability within the ksmbd module related to processing SMB2 write requests. Specifically, the function ksmbd_smb2_check_message fails to validate the NextCommand field correctly. When NextCommand exceeds the sum of Offset and Length in a smb2 write operation, it can lead to oversized write lengths. This mismanagement ultimately allows for out-of-bounds reads, potentially exposing sensitive information in memory.

References